Linux Analysis Report
Nmg21us74I

Overview

General Information

Sample Name: Nmg21us74I
Analysis ID: 679506
MD5: 01ec15a16805e0b57d0ef42097dca5ec
SHA1: d9ea867164e9ad0c1901b85c8f18174743e1a0b4
SHA256: a3946c00d0daf54a7e99a22e731dbc7977936ef6c9591dd0ae2a45632626b357
Tags: 32armelfmirai
Infos:

Detection

Mirai
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample deletes itself
Uses known network protocols on non-standard ports
Yara signature match
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Nmg21us74I Avira: detected
Multi AV Scanner detection for submitted file
Source: Nmg21us74I Virustotal: Detection: 57% Perma Link
Source: Nmg21us74I ReversingLabs: Detection: 67%

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46570
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46574
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46582
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46590
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46600
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46602
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46604
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46606
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46608
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55188
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55200
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55210
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55226
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55230
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55232
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55234
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55238
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55240
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55242
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:53692 -> 163.123.143.71:34241
Sample listens on a socket
Source: /tmp/Nmg21us74I (PID: 6230) Socket: 127.0.0.1::42516 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) Socket: 0.0.0.0::23 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) Socket: 0.0.0.0::81 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) Socket: 0.0.0.0::8443 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) Socket: 0.0.0.0::9009 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) Socket: 0.0.0.0::23 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) Socket: 0.0.0.0::81 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) Socket: 0.0.0.0::8443 Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) Socket: 0.0.0.0::9009 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 247.69.125.15
Source: unknown TCP traffic detected without corresponding DNS query: 89.62.97.13
Source: unknown TCP traffic detected without corresponding DNS query: 201.64.150.235
Source: unknown TCP traffic detected without corresponding DNS query: 99.33.248.85
Source: unknown TCP traffic detected without corresponding DNS query: 201.133.179.101
Source: unknown TCP traffic detected without corresponding DNS query: 123.213.193.207
Source: unknown TCP traffic detected without corresponding DNS query: 1.55.165.112
Source: unknown TCP traffic detected without corresponding DNS query: 24.220.186.101
Source: unknown TCP traffic detected without corresponding DNS query: 171.190.215.92
Source: unknown TCP traffic detected without corresponding DNS query: 74.219.179.190
Source: unknown TCP traffic detected without corresponding DNS query: 68.55.130.165
Source: unknown TCP traffic detected without corresponding DNS query: 185.134.162.198
Source: unknown TCP traffic detected without corresponding DNS query: 186.120.206.202
Source: unknown TCP traffic detected without corresponding DNS query: 77.237.72.112
Source: unknown TCP traffic detected without corresponding DNS query: 174.100.78.43
Source: unknown TCP traffic detected without corresponding DNS query: 223.213.17.120
Source: unknown TCP traffic detected without corresponding DNS query: 115.70.188.226
Source: unknown TCP traffic detected without corresponding DNS query: 246.88.72.79
Source: unknown TCP traffic detected without corresponding DNS query: 74.4.255.140
Source: unknown TCP traffic detected without corresponding DNS query: 102.96.34.54
Source: unknown TCP traffic detected without corresponding DNS query: 32.126.77.119
Source: unknown TCP traffic detected without corresponding DNS query: 112.187.57.147
Source: unknown TCP traffic detected without corresponding DNS query: 203.108.232.50
Source: unknown TCP traffic detected without corresponding DNS query: 193.38.42.40
Source: unknown TCP traffic detected without corresponding DNS query: 247.249.136.144
Source: unknown TCP traffic detected without corresponding DNS query: 92.175.108.39
Source: unknown TCP traffic detected without corresponding DNS query: 217.67.41.171
Source: unknown TCP traffic detected without corresponding DNS query: 14.179.207.111
Source: unknown TCP traffic detected without corresponding DNS query: 40.187.84.210
Source: unknown TCP traffic detected without corresponding DNS query: 16.28.78.124
Source: unknown TCP traffic detected without corresponding DNS query: 176.2.125.141
Source: unknown TCP traffic detected without corresponding DNS query: 46.15.198.202
Source: unknown TCP traffic detected without corresponding DNS query: 190.75.209.114
Source: unknown TCP traffic detected without corresponding DNS query: 117.38.60.242
Source: unknown TCP traffic detected without corresponding DNS query: 167.69.41.250
Source: unknown TCP traffic detected without corresponding DNS query: 161.24.53.149
Source: unknown TCP traffic detected without corresponding DNS query: 83.225.24.201
Source: unknown TCP traffic detected without corresponding DNS query: 176.136.18.174
Source: unknown TCP traffic detected without corresponding DNS query: 95.2.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 197.117.13.64
Source: unknown TCP traffic detected without corresponding DNS query: 117.20.163.155
Source: unknown TCP traffic detected without corresponding DNS query: 242.36.164.230
Source: unknown TCP traffic detected without corresponding DNS query: 186.200.170.6
Source: unknown TCP traffic detected without corresponding DNS query: 94.33.47.97
Source: unknown TCP traffic detected without corresponding DNS query: 19.183.144.84
Source: unknown TCP traffic detected without corresponding DNS query: 142.183.217.180
Source: unknown TCP traffic detected without corresponding DNS query: 65.118.148.19
Source: unknown TCP traffic detected without corresponding DNS query: 173.151.241.139

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Nmg21us74I, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Nmg21us74I, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Yara signature match
Source: Nmg21us74I, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Nmg21us74I, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/Nmg21us74I (PID: 6234) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) SIGKILL sent: pid: 6234, result: successful Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: classification engine Classification label: mal88.troj.evad.lin@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/491/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/793/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/772/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/796/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/774/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/797/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/777/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/799/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/658/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/912/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/759/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/936/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/918/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/1/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/761/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/785/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/884/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/720/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/721/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/788/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/789/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/800/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/801/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/847/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6234) File opened: /proc/904/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/6234/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/6191/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/6191/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/6190/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/6190/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/910/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/912/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/912/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/912/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/759/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/759/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/759/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/517/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/918/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/918/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/918/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/6243/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/6244/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/761/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/761/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/761/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/884/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/884/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/884/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/Nmg21us74I (PID: 6250) File opened: /proc/1344/exe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/Nmg21us74I (PID: 6230) File: /tmp/Nmg21us74I Jump to behavior
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46570
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46574
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46582
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46590
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46596
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46600
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46602
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46604
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46606
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46608
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55188
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55200
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55210
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55226
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55230
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55232
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55234
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55238
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55240
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 55242
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/Nmg21us74I (PID: 6230) Queries kernel information via 'uname': Jump to behavior
Source: Nmg21us74I, 6230.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6234.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6236.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6252.1.0000565170586000.00005651706b4000.rw-.sdmp Binary or memory string: YpQV!/etc/qemu-binfmt/arm
Source: Nmg21us74I, 6230.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6234.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6236.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6252.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp Binary or memory string: K x86_64/usr/bin/qemu-arm/tmp/Nmg21us74ISUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Nmg21us74I
Source: Nmg21us74I, 6230.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6234.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6236.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6252.1.0000565170586000.00005651706b4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: Nmg21us74I, 6230.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6234.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6236.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6252.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: Nmg21us74I, type: SAMPLE
Source: Yara match File source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: Nmg21us74I, type: SAMPLE
Source: Yara match File source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
105.22.224.11
 unknown Mauritius
37100 SEACOM-ASMU false
245.116.1.135
 unknown Reserved
unknown unknown false
222.233.103.170
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
246.9.2.21
 unknown Reserved
unknown unknown false
157.3.239.204
 unknown Japan 7671 MCNETNTTSmartConnectCorporationJP false
108.178.45.135
 unknown United States
32475 SINGLEHOP-LLCUS false
18.229.102.137
 unknown United States
16509 AMAZON-02US false
32.160.66.218
 unknown United States
2686 ATGS-MMD-ASUS false
53.16.36.106
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
76.28.59.66
 unknown United States
7922 COMCAST-7922US false
121.92.158.157
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
223.201.67.26
 unknown China
4782 GSNETDataCommunicationBusinessGroupTW false
246.109.35.181
 unknown Reserved
unknown unknown false
141.52.191.37
 unknown Germany
34878 KITKarlsruheInstituteofTechnologyDE false
77.69.178.110
 unknown Bahrain
5416 InternetServiceProviderBH false
133.192.104.39
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
32.48.63.177
 unknown United States
7018 ATT-INTERNET4US false
75.36.168.76
 unknown United States
7018 ATT-INTERNET4US false
100.173.129.169
 unknown United States
21928 T-MOBILE-AS21928US false
141.227.0.199
 unknown France
21070 TOTALFR false
120.169.246.82
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
209.92.249.69
 unknown United States
7029 WINDSTREAMUS false
54.140.144.36
 unknown United States
14618 AMAZON-AESUS false
111.231.40.22
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
254.106.28.224
 unknown Reserved
unknown unknown false
166.117.52.131
 unknown United States
58681 NSWPOLSERV-AS-APNewSouthWalesPoliceAU false
196.135.11.103
 unknown Egypt
36935 Vodafone-EG false
104.80.152.99
 unknown United States
16625 AKAMAI-ASUS false
98.173.208.29
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
179.53.118.76
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
90.192.140.251
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
16.11.95.214
 unknown United States
unknown unknown false
186.178.15.174
 unknown Ecuador
28006 CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC false
13.71.171.245
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
94.146.159.116
 unknown Denmark
9158 TELENOR_DANMARK_ASDK false
118.150.116.140
 unknown Taiwan; Republic of China (ROC)
18419 DADA-AS-TWDaDaBroadbandLTDTW false
170.131.82.35
 unknown United States
13954 STAPLESUS false
89.248.107.35
 unknown Spain
48348 CLOUDBUILDERSES false
197.53.119.202
 unknown Egypt
8452 TE-ASTE-ASEG false
57.5.138.225
 unknown Belgium
2686 ATGS-MMD-ASUS false
191.153.57.180
 unknown Colombia
26611 COMCELSACO false
93.123.76.73
 unknown Bulgaria
43561 NET1-ASBG false
208.41.137.69
 unknown United States
4565 MEGAPATH2-US false
197.161.195.3
 unknown Egypt
24863 LINKdotNET-ASEG false
220.65.188.96
 unknown Korea Republic of
9316 DACOM-PUBNETPLUS-AS-KRDACOM-PUBNETPLUSKR false
81.211.32.43
 unknown Russian Federation
3216 SOVAM-ASRU false
117.142.30.125
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
203.54.162.175
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
88.125.239.228
 unknown France
12322 PROXADFR false
210.84.92.204
 unknown Australia
703 UUNETUS false
73.233.169.114
 unknown United States
7922 COMCAST-7922US false
51.14.10.117
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
124.28.140.227
 unknown Korea Republic of
23578 NAMDONGNET-AS-KRTBROADSaeromNamdongSeohaebroadcastingKR false
162.119.15.38
 unknown United States
3379 KAISER-NCALUS false
185.41.237.242
 unknown Belgium
199942 CHEOPSBE false
45.1.177.213
 unknown United States
7377 UCSDUS false
43.110.214.123
 unknown Japan 4249 LILLY-ASUS false
14.245.235.120
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
111.208.128.52
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
72.137.191.183
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
160.39.196.228
 unknown United States
14 COLUMBIA-GWUS false
181.104.155.22
 unknown Argentina
6147 TelefonicadelPeruSAAPE false
82.221.170.8
 unknown Iceland
30818 IS-ADVANIA-TRANSITIS false
66.141.134.12
 unknown United States
7018 ATT-INTERNET4US false
121.137.201.237
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
172.7.251.188
 unknown United States
7018 ATT-INTERNET4US false
252.163.150.243
 unknown Reserved
unknown unknown false
122.114.141.69
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
153.161.19.176
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
124.94.70.87
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
75.50.159.107
 unknown United States
7018 ATT-INTERNET4US false
162.5.54.167
 unknown United States
33348 PIERCE-COUNTYUS false
201.68.106.106
 unknown Brazil
27699 TELEFONICABRASILSABR false
44.78.82.191
 unknown United States
7377 UCSDUS false
67.0.96.13
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
244.53.184.180
 unknown Reserved
unknown unknown false
151.168.66.12
 unknown United States
45025 EDN-ASUA false
112.107.186.81
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
145.22.219.194
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
61.230.253.244
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
35.25.130.31
 unknown United States
36375 UMICH-AS-5US false
72.155.239.236
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
87.203.200.222
 unknown Greece
6799 OTENET-GRAthens-GreeceGR false
69.234.250.41
 unknown China
7018 ATT-INTERNET4US false
36.96.13.140
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
9.215.94.18
 unknown United States
3356 LEVEL3US false
213.121.90.101
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
152.50.33.117
 unknown United States
81 NCRENUS false
194.194.0.57
 unknown European Union
2686 ATGS-MMD-ASUS false
243.144.161.246
 unknown Reserved
unknown unknown false
159.86.109.59
 unknown United Kingdom
1945 FR-LYRESLyonRechercheetEnseignementSuperieurLyRESE false
75.10.61.95
 unknown United States
7018 ATT-INTERNET4US false
113.20.55.68
 unknown New Caledonia
45461 TELENET-AS-APTeleNetNC false
117.71.137.154
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
182.9.51.16
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
93.56.245.69
 unknown Italy
12874 FASTWEBIT false
24.75.110.232
 unknown United States
3356 LEVEL3US false
121.45.181.169
 unknown Australia
4739 INTERNODE-ASInternodePtyLtdAU false
112.167.3.3
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
197.204.101.39
 unknown Algeria
36947 ALGTEL-ASDZ false